Switching the Electron Builder appId back to its original value (like, app.<yourapp>.com) stopped it from exactly matching the bundle ID in the provisioning profile, so codesign no longer injected a keychain-access-groups entitlement and the key-chain prompt disappeared.
The wildcard in the same provisioning profile still covers the app, so the Automatic Assessment Configuration entitlement is honored and assessment mode continues to work.